On 25/03/2013 14:33, Mikael Abrahamsson wrote:
I would like to be able to request an IP list of open resolvers in my ASN,
perhaps sent to the contact details in RIPE whois database to make sure I'm
not falsely representing that ASN.
Or you could just get an off-site system (cloud VM), get the software from
http://monkey.org/~provos/dnsscan/, and find all your own open recursive
DNS servers.
There are different levels of openness for recursive DNS servers though.
It looks like Jared's project lists any DNS server that responds with
anything other than refused as open. A DNS server could have open
recursion "disabled", but still respond with referrals to the
root-servers. Older versions of bind seem to do this when configured with
allow-recursion for a limited range of IPs. While not really "open" such
servers are still useful for DNS amplification. The example config at
http://www.team-cymru.org/Services/Resolvers/instructions.html
for a bind 9.x caching server can be adapted for older bind versions
doing caching+authoratative such that it'll provide recursion to
those who should have it, and authority for zones for which it needs to do
so.
----------------------------------------------------------------------
Jon Lewis, MCP :) | I route
| therefore you are
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
